The Amelia booking plugin for WordPress contains a flaw in its payments listing endpoint. User supplied input in the 'sort' parameter is directly interpolated into an ORDER BY clause without sanitization, creating a classic SQL injection vector. Because PDO prepared statements do not protect column names, an attacker with Manager or higher privileges can add additional SQL statements via the GET request, bypassing nonce validation. The outcome is the ability to perform time‑based blind SQL injection to read sensitive database contents, potentially exposing user data and other confidential information.

All installations of the Amelia WordPress plugin up to and including version 2.1.2 are affected. The vulnerability applies only to users with Manager-level permissions or higher within WordPress.

The CVSS score of 6.5 indicates a moderate to high severity problem, whereas the lack of an EPSS score leaves the exact likelihood of exploitation unclear. Aside from a lack of inclusion in the KEV catalogue, the flaw is exploitable over the network as a GET request does not trigger any nonce check. Because only administrators or managers can trigger it, the attack requires that the attacker already be authenticated with sufficient privileges, but given the potential to extract important data, the risk remains significant for affected sites.